Deploy on push to main (safe)
Goal: Automate deployment while keeping secrets secure and rollbacks possible.
- Use GitHub Secrets for SSH keys and environment vars.
- Run `docker compose up --build -d` on your server via SSH action.
- Log outputs and fail the workflow if deployment fails.
- Add a simple health check step after deploy.
- Add manual approval for production if you need a gate.